Steps to reproduce the problem:
These steps highlight an unsafe code path in the Tab saving logic.
(1) Create a frozen tab and retrieve its tab state via tab.getState().
(2) Open a FileOutputStream on the tab's state file.
(3) Call TabState.saveState with the output stream, the tab state retrieved in step 1, and a value of "false" for the "incognito" argument.
(4) Reload the saved tab via a call to TabState.restoreState.

What is the expected behavior?
The tab state is successfully reloaded.

What went wrong?
The FileChannel.map fails with an "IOException: ftruncate failed" error.

Did this work before? N/A 

Chrome version: 54.0.2786.0  Channel: stable
OS Version: 4.4.3
Flash Version: Shockwave Flash 22.0 r0

The TabState.saveState call fails because it attempts to write state.contentsState.buffer() to the output file. However, the .buffer object is of type ByteBuffer and is in some cases an instance of MappedByteBuffer that is mapped to the same output file being written to. For instance, this can happen if the tab being saved is a frozen tab - a use case that is not forbidden/guarded against in the code. 

In these cases, the write will fail because opening a FileOutputStream on the file will truncate the file's contents and will thus invalidate the memory addresses that the MappedByteBuffer is pointing to. This results in an incomplete save of the tab state, which can lead to failed/incomplete restorations that are difficult to track down.